zk-SNARKs on Bitcoin: Run Zcash on Bitcoin

Share This Post

This publish was first printed on Medium.

Beforehand, we’ve proved one is aware of some mathematical secret utilizing zero data proof (ZKP), with out revealing the key itself. The key data embrace:

Whereas helpful of their particular purposes, these ZKPs can’t be utilized to arbitrary mathematical features. Overcoming these limitations, a zk-SNARK (zero-knowledge Succinct Non-interactive ARguments of Oknowledgeis a protocol designed to generate a ZKP for any mathematical perform. The generated proof is “succinct” and “non-interactive”: a proof is only some hundred bytes and might be verified in fixed time and inside a number of milliseconds, with no need to ask extra questions of the prover. Collectively, these properties make zk-SNARK particularly appropriate for blockchains, the place on-chain storage and computation might be costly and senders usually go offline after sending a transaction. Nameless cryptocurrency Zcash and the smart-contract platform Ethereum are amongst its notable early adopters, amongst others.


A zk-SNARK consists of the next three algorithms: G ,P, andV.

Key Era

A key generator G takes a secret parameter λ and a perform C, and produces a proving key pk and a verification key vk. Each keys are made public.

Key Generator

C is a boolean perform (additionally referred to as a program or circuit) that takes two inputs: a public enter x and a non-public enter w (aka, witness). For instance, C could be a perform that checks if w is the sha256 preimage of the digest x.

C(x, w) = sha256(w) == x


The prover P takes as enter the proving key pk, a public enter x and a non-public witness w to provide a proof that the prover is aware of a witness w that makes C(x, w) evaluates to true.



The verifier V takes verification key vk, the proof, and the general public enter x and accepts the proof solely whether it is produced with the data of witness w¹.



When zk-SNARKs are utilized in blockchains, each the important thing and proof technology are executed off-chain. Solely the overall verification algorithm is run inside a sensible contract on chain.

There are a number of schemes of zk-SNARKs within the literature. We implement essentially the most broadly used scheme Groth16 attributable to its small proof dimension and quick verification.

Verifier in Groth16: page 18
Verifier in Groth16: web page 18

The complete code is listed beneath, based mostly on our elliptic curve arithmetic and pairing libraries.

Contract ZKSNARK

It’s value noting that the proof dimension (Line 23–27) and the variety of pairings (Line 43–44) are fixed, no matter how complicated the perform C being proved is.


zk-SNARK is a robust primitive for blockchain privateness and scalability. As we speak we solely confirmed what zk-SNARK is and methods to implement it on Bitcoin. We’ll discover methods to use it within the close to future. Why and the way it works internally, which is kind of math heavy, is past the scope of this single article. There are numerous wonderful tutorials equivalent to this sequence and this paper.



[1] There’s an exception. Anybody is aware of the key parameter λ used within the generator can generate pretend but legitimate proof with out data of witness. That’s the reason it’s referred to as poisonous waste. It have to be discarded after the trusted setup part.

Watch: The BSV World Blockchain Conference presentation, Sensible Contracts and Computation on BSV

New to Bitcoin? Take a look at CoinGeek’s Bitcoin for Inexperienced persons part, the final word useful resource information to be taught extra about Bitcoin—as initially envisioned by Satoshi Nakamoto—and blockchain.


Related Posts

Enterprise Information | Inventory and Share Market Information | Finance Information

Search Quotes, Information, Mutual Fund NAVs Reliance INE002A01018, RELIANCE, 500325 ONGC INE213A01029, ONGC,...

Craig Wright on Bitcoin and the reactionary response to a revolt

With the current worth downturn within the digital asset...

Bitcoin fund charges tumble amid ‘crypto winter’

Newest information on ETFsGo to our ETF Hub to...
- Advertisement -spot_img